Public Key Exchange
draft-harkins-pkex-04

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03
• 04
• 05
• 06

Internet Research Task Force                                  D. Harkins
Internet-Draft                                             HP Enterprise
Intended status: Informational                             July 28, 2017
Expires: January 29, 2018

                          Public Key Exchange
                         draft-harkins-pkex-04

Abstract

   This memo describes a password-authenticated protocol to allow two
   devices to exchange "raw" (uncertified) public keys and establish
   trust that the keys belong to their respective identities.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on January 29, 2018.

Copyright Notice

   Copyright (c) 2017 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Harkins                 Expires January 29, 2018                [Page 1]
Internet-Draft                    PKEX                         July 2017

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
     1.1.  Requirements Language . . . . . . . . . . . . . . . . . .   3
     1.2.  Notation  . . . . . . . . . . . . . . . . . . . . . . . .   3
   2.  Properties  . . . . . . . . . . . . . . . . . . . . . . . . .   4
   3.  Assumptions . . . . . . . . . . . . . . . . . . . . . . . . .   5
   4.  Cryptographic Primitives  . . . . . . . . . . . . . . . . . .   5
   5.  Protocol Definition . . . . . . . . . . . . . . . . . . . . .   6
     5.1.  Exchange Phase  . . . . . . . . . . . . . . . . . . . . .   6
     5.2.  Commit/Reveal Phase . . . . . . . . . . . . . . . . . . .   7
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   8
   7.  Security Considerations . . . . . . . . . . . . . . . . . . .   9
   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   9
     8.1.  Normative References  . . . . . . . . . . . . . . . . . .   9
     8.2.  Informative References  . . . . . . . . . . . . . . . . .  10
   Appendix A.  Role-specific Elements . . . . . . . . . . . . . . .  10
     A.1.  ECC Role-specific Elements  . . . . . . . . . . . . . . .  11
       A.1.1.  Role-specific Elements for NIST p256  . . . . . . . .  11
       A.1.2.  Role-specific Elements for NIST p384  . . . . . . . .  12
       A.1.3.  Role-specific Elements for NIST p521  . . . . . . . .  13
       A.1.4.  Role-specific Elements for brainpool p256r1 . . . . .  15
       A.1.5.  Role-specific Elements for brainpool p384r1 . . . . .  15
       A.1.6.  Role-specific Elements for brainpool p512r1 . . . . .  16
     A.2.  FFC Role-specific Elements  . . . . . . . . . . . . . . .  17
       A.2.1.  Role-specific Elements for 2048-bit FFC group . . . .  18
       A.2.2.  Role-specific Elements for 3072-bit FFC group . . . .  19
       A.2.3.  Role-specific Elements for 4096-bit FFC group . . . .  21
       A.2.4.  Role-specific Elements for 8192-bit FFC group . . . .  24
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  30

1.  Introduction

   Many authenticated key exchange protocols allow for authentication
   using uncertified, or "raw", public keys.  Usually these
   specifications-- e.g.  [RFC7250] for TLS and [RFC7670] for IKEv2--
   assume keys are exchanged in some out-of-band mechanism.

   [RFC7250] further states that "the main security challenge [to using
   'raw' public keys] is how to associate the public key with a specific
   entity.  Without a secure binding between identifier and key, the
   protocol will be vulnerable to man-in-the- middle attacks."

   The Public Key Exchange (PKEX) is designed to fill that gap: it
   establishs a secure binding between exchanged public keys and
   identifiers, it provides proof-of-possession of the exchanged public
   keys to each peer, and it enables the establishment of trust in